According to Section 5.3 of Ordinance No. 9/2018, data, metadata, information and knowledge produced or stored by Federal Public Administration (FPA) bodies and its backups shall reside in the Brazilian territory. In addition, Section 5.4 stipulates that the data, metadata, information and knowledge generated or held by a FPA entity or body relating to personal data (relating to intimacy, privacy, honour and image), information with restricted access under current legislation and preparatory documents may be processed in a cloud computing environment at the discretion of the FPA entity or body, taking into account current legislation, but must reside exclusively on Brazilian territory. According to the Complementary Standard 09/IN01/DSIC/GSI/PR, the bodies and entities of the FPA must comply with certain procedures, one of which can be found in Section 5.3, which states that all confidential information can only be stored in a data processing centre provided by the bodies and entities of the FPA, in accordance with the legislation in force. Confidential information is defined as information that is temporarily restricted from public access due to its indispensability for the security of society and the State.
Also, Section 5.2.2.1 of Ordinance No. 9/2018 states that processing of classified information in a cloud computing environment is prohibited. Classified information is defined as confidential information that has been assigned a degree of secrecy in accordance with specific classification procedures set out in applicable legislation.

Art. 12 of Resolution CMN No. 4,893 and Art. 12 of Resolution BCB No. 85 state that institutions authorised to operate by the Central Bank of Brazil (Banco Central do Brasil, BCB) may contract cloud and data processing services in Brazil or abroad as long as they adopt corporate governance practices proportionate to the service hired and the risks to which they are exposed to, and verify the capability of the potential service to ensure compliance with the current legislation, institution's access to data, the confidentiality and integrity of data, adherence to certification patterns required by the institution, access to auditing reports, provision of information and management resources appropriate to the monitoring of services provided, identification of the institution's customer data and quality of access controls aimed at protecting customers data. In addition, Art. 15 of both Resolutions establishes that the companies should notify BCB of the countries where financial data is processed. Also, Art. 16 of both Resolutions provides that the contracting of data processing, data storage and cloud computing relevant services provided abroad must fulfil the following requisites:
- The existence of an agreement for the exchange of information between the BCB and the supervisory authorities of the countries where the services may be provided;
- The contracting institution must ensure that the provision of the services does not cause damage to its own functioning, neither do they deter the action of the BCB;
- The contracting institution must define, previously to the contracting, the countries and the regions in each country where the services can be provided and the data can be stored, processed and managed;
- The contracting institution must anticipate alternatives for business continuity, either in the case of the impossibility of continuing the contract or terminating it.
The BCB's prior approval must be obtained if the institution retains a cloud service provider in countries where there is no agreement to exchange information between the BCB and the competent authorities. The institutions must request such approval from the BCB at least 60 days before retaining the cloud services in question.

The Personal Data Protection Law allows the international transfer of personal data only under certain conditions (Arts. 33-36). The main conditions for such a transfer are that the recipient jurisdiction has an adequate level of data protection; the controller adduces adequate safeguards (for instance, by using model contract clauses, binding corporate rules or other contractual arrangements); the data subject has given their consent explicitly; or the transfer is necessary for the performance of a contract between the data subject and the controller. Art. 11 provides stricter conditions for processing sensitive personal data, and it is reported that, in practice, these conditions forced many organisations to store privacy-sensitive data in Brazil. The law applies extraterritorially to all companies that target Brazilian consumers, even when the company is not established in the Brazilian market.

Brazil has joined an agreement with binding commitments to open data transfers across borders: the Chile-Brazil Bilateral Trade Agreement (Art. 10.12).

The Personal Data Protection Law provides a framework for comprehensive data protection in Brazil. It applies to the treatment of personal data, including through digital means, by natural or juridical persons of a public or private nature. The law applies regardless of the country of origin of the person and the country where data is located provided that: data treatment is made in the national territory; or data treatment activities aims at the supply of goods or services or data treatment of individuals located in the national territory; or data has been collected in the national territory.

Art. 13 of the Civil Rights Framework for the Internet states that connection logs of Internet service providers (ISPs) should be retained for a minimum period of one year. The police, administrative authorities, or the Public Prosecutor's Office may request in a precautionary manner that the connection logs be kept for a longer period. Authorities have a period of 60 days, counting from the time of the request, to obtain a court order to access the information.

According to Art. 15 of the Civil Rights Framework for the Internet, internet application providers that are constituted as a legal entity and that carry out this activity in an organised manner professionally and with economic purposes must retain the respective records of access to the Internet applications for a period of six months. Internet applications are defined in Art. 5 (VII) as a set of functionalities that can be accessed through a terminal connected to the Internet.

According to Art. 17 of Criminal Organisation Law, concessionaires of fixed or mobile telephony must keep, for a period of five years, at the disposal of the Police Chief or the Public Prosecutor, records of identification of the terminal numbers of origin and destination of international, long distance and local phone calls.

The Guidelines for the Appointment of Data Treatment Agents and Data Protection Officers clarify Art. 41 of the Data Protection Law, setting out that all institutions, either public or private, have an obligation to appoint a Data Protection Officer ("encarregado") (DPO). A previous reading of the Art. 23 of Law led to the conclusion that only public institutions would be obliged to appoint a DPO. However, the guidelines state that the Data Protection Law does not determine the circumstances in which an organisation should appoint a DPO. Therefore, as a general rule, one must assume that all organisations must appoint a DPO. However, §3 of Art. 41 states that future regulations of the National Authority may determine the hypothesis for the dispensation of the need to appoint a DPO, taking into account the nature, size, and volume of data treatment operations

Brazil has established an obligation for passive infrastructure sharing to deliver telecom services to end users. In addition, passive infrastructure sharing is practised in the mobile sector and in the fixed sector. According to Art. 73 of Law No. 9,472/1997, telecom service providers of collective interest have the right to use posts, ducts, conduits, and easements owned or controlled by a provider of telecom services or other services of public interest in a non-discriminatory manner and at fair and reasonable prices and conditions. On the other hand, Law No. 13,116/2015 establishes general rules for the implementation and sharing of telecommunications infrastructure. Additionally, Resolution No. 683/2017 of the "Agência Nacional de Telecomunicações" (Anatel, National Telecommunications Agency) approved the Regulation for Sharing Support Infrastructure to the Provision of Telecommunications Services, which aims to discipline the sharing of infrastructure.

Telecomunicações Brasileiras SA (Telebras), the former incumbent, is a state-owned company created by Law No. 5,792 of July 1972. As established by Decree No. 7.175 of 2010, its task is to implement public policies related to the universalisation of telecommunications access in Brazil. As of December 2022, it was reported that the government-owned approximately 97% of the company's shares. Of these, 93% were held by the Federal Government, while 4% were held by Financiadora de Estudos e Projetos (FINEP). FINEP, a Brazilian federal organisation under the Ministry of Science and Technology, is responsible for financing scientific and technological advancements in the country.

It is reported that Brazil mandates functional and accounting separation for operators with significant market power (SMP) in the telecom market.

According to Art. 86 of the General Telecommunications Law, a telecommunication service license can only be granted to companies organised and existing under Brazilian law and which have their principal place of business and administration in Brazil. Furthermore, Art. 87 determines that any company or holding company granted a concession that already renders, in the same geographical area, the same type of service subject to a bidding procedure will be obliged to transfer the service previously rendered to a third party within 18 months from the execution date of the concession agreement. Failure to observe this provision can result in forfeiture of the license, as well as other sanctions set out in the grant procedure.

It has been reported that although Brazil permits Brazilian-owned entities to acquire the exclusive right to operate a satellite and its associated frequencies from specific positions, foreign-licensed satellite operators may obtain only a non-exclusive right (a landing right) to provide service in Brazilian territory. The National Telecommunications Agency (ANATEL) grants these landing rights for a fixed term of no longer than 15 years, after which the operator must reacquire the landing rights in order to continue providing services. Foreign operators are also required to pay higher annual landing fees than Brazilian firms.

Brazil has not appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.